alesian.security
← Top 100 Domains

nginx.com

Number 86 of the Top 100 · Tranco rank 96

nginx.com is the commercial side of nginx, owned by F5. The open-source project lives at nginx.org.

Can nginx.com be forged?

Can nginx.com be forged?

No. Receivers that check DMARC refuse mail that forges nginx.com or its subdomains.

The exact name
reject · subdomains reject · reports to Valimail
Names that copy
27 registered lookalikes can send mail. DMARC never sees them. See them →

What we noticed

  • exists:%{i}.spf.hc5801-97.iphmx.com resolves for each message, so the senders it allows cannot be listed from outside.
  • The SPF record marks an unlisted sender as a soft failure. A hard failure is stronger.
Senders it names Microsoft 365
  • Microsoft 365 include:spf.protection.outlook.com· DKIM key found

These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.

SPF~all · 2 of 10 lookups · at least 459 thousand addresses

Flags others · 2 of 10 lookups · 0 of 2 void lookups · 458,756 IPv4 addresses · 5 IPv6 blocks · Kept by a sender-policy service

The full list cannot be known from outside: it uses macros.

Every term and include
  • 1 — —
  • 1 — —
  • 1 — —
  • 1 — —
  • their record 458,752 118,784 /64s 1
  • exists:%{i}.spf.hc5801-97.iphmx.com resolves for each message, so its senders cannot be listed — — 1
  • ~all — — —
    • DKIM2 keys found
    • selector1._domainkey · rsa 1024· Microsoft 365
    • selector2._domainkey · rsa 1024· Microsoft 365

    We look under the selectors of the services the records name. A domain can have keys we do not find.

    Sending names 2 names, 2 at reject
    NamePolicySPF lookupsReports to
    ns.nginx.comreject (inherited)0—
    ns3.nginx.comreject (inherited)0—
    ReportsValimail

    Aggregate reports (rua) go to mailto:dmarc_agg@vali.email. Failure reports (ruf) are asked for.

    Transport MTA-STS none · TLS-RPT none · BIMI none

    MTA-STS asks senders to deliver to nginx.com over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.

    Read on Oct 28, 2026. Check it again yourself →

    Watch your own domain's mail this way: Sender Security · the DMARC Report